Read Smali Code: Registers, Methods and Control Flow

Learn the method boundary first

A small illustrative method is:

.method public static add(II)I
    .locals 1
    add-int v0, p0, p1
    return v0
.end method

Here the descriptor says two integer parameters and an integer return. Because the method is static, p0 and p1 are those parameters; an instance method also has an implicit receiver. The local register stores the result. This is a teaching example, not recovered code from a real app. Dalvik instruction reference.

Read descriptors without guessing

I represents an integer, V a void return, and object types use a form such as Ljava/lang/String;. Arrays have a leading [. A method name alone is not enough to identify an overload; include the full descriptor.

Register allocation and compiler optimizations can make the same high-level operation look different across builds. Focus on data flow rather than expecting the original source variable names.

Follow calls and branches

For each relevant method, identify the parameter values entering it, the values passed to invoked methods and the branch conditions controlling sensitive operations. Labels and jump instructions define the paths. Exception handlers create additional control-flow edges that a simple top-to-bottom reading misses.

After an invocation returning a value, look for the corresponding result-handling instruction. Do not assume a call succeeded merely because the next line in a Java-like decompiler view appears straightforward.

Use JADX and Smali together

JADX can give a readable high-level approximation and cross-references. When it warns about a method or produces implausible logic, inspect the DEX/Smali representation instead of silently trusting the approximation. JADX documentation.

A useful analysis note states the exact class and method descriptor, the observed instruction path and the uncertainty remaining. “The app probably does X” is weaker than a traceable description of the relevant calls.

Keep the exercise authorized and non-destructive

Use a small app you wrote to compare source, compiled output and disassembly. Change one source construct at a time—an if, a loop or a nullable value—and observe what the compiler produces. That teaches more than copying unexplained patches into someone else's release.

APKLint's DEX / Smali Analyzer can assist structural inspection. It does not restore source comments, establish intent or guarantee that modifying a method will preserve signing and runtime correctness.